Feb 9, 2023

Jump to: What you’ll need to install Zeek The only things you’ll need to install Zeek are a running instance of Ubuntu Server 22.04 or newer and a user with sudo privileges. How to install Zeek The first thing to be done is to log in to your Ubuntu Server instance. Once you’ve successfully logged in, install a trio of simple dependencies with the command: sudo apt-get install curl wget gnupg2 -y Next, change to the root user with: sudo -s curl -fsSL https://download.opensuse.org/repositories/security:zeek/xUbuntu_22.04/Release.key | gpg --dearmor | tee /etc/apt/trusted.gpg.d/security_zeek.gpg Add the Zeek repository with the command: echo 'deb http://download.opensuse.org/repositories/security:/zeek/xUbuntu_22.04/ /' | tee /etc/apt/sources.list.d/security:zeek.list Update apt: apt-get install zeek -y During the installation, you’ll be asked how you would like to configure Postfix. Unless you already have a mail server up and running on the system, I would suggest configuring it as local only. You will have to log in to the server and check the admin users’ mail account to see any reports, which is done with the command mail. If the mail command doesn’t exist, install it with: apt-get install mailutils -y echo "export PATH=$PATH:/opt/zeek/bin" >> ~/.bashrc Source the bash file with: source ~/.bashrc How to configure Zeek After the Zeek installation completes, you’ll need to make some changes to the configuration file. Open the file with: nano /opt/zeek/etc/networks.cfg You’ll want to add your network to the bottom of the default list, which will look something like this: 10.0.0.0/8          Private IP space zeekctl deploy zeekctl status Name         Type    Host             Status    Pid    Started zeek-logger  logger  192.168.1.191    running   6366   06 Feb 13:18:44 zeek-manager manager 192.168.1.191    running   6427   06 Feb 13:18:49 zeek-proxy   proxy   192.168.1.191    running   6488   06 Feb 13:18:54 zeek-worker  worker  192.168.1.191    running   6570   06 Feb 13:19:00 zeek-worker-lo worker  localhost        running   6567   06 Feb 13:19:00 Zeek stores its logs in /opt/zeek/logs/current. You’ll find a log for broker, cluster, packet_filtering, conn, loaded_scripts, reporter, stats, stderr, stdout, telemetry and weird. The best way to view these logs is using the tail command to view them updated in real-time, like so: tail -f /opt/zeek/logs/current/conn.log That log file will display all real-time connections to the server. Another handy trick you can try is viewing tcpdump information with Zeek. First, capture some packets with the command: sudo tcpdump -i IFACE -s 0 -w mypackets.trace Where IFACE is the name of the network device on the host. After giving that a few minutes to run, end the command with CTRL+C and then analyze the traffic with: zeek -r mypackets.trace Zeek will dump the log files into the current working directory. You should see the following log files: conn.log, dns.log, mypackets.trace, packet_filter.log, reporter.log and weird.log. Let’s say you then want to run one of Zeek’s built-in scripts against the captured packets. For that, you could issue something like this: zeek -r mypackets.trace /opt/zeek/share/zeek/policy/frameworks/files/extract-all-files.zeek Make Zeek yours Zeek is a very powerful network monitoring tool. You’ll want to get up to speed with the various built-in scripts and even learn how to build your own. Until you reach that point, you can continue viewing the standard log files and capturing packages that enter and leave your server. Subscribe to TechRepublic’s How To Make Tech Work on YouTube for all the latest tech advice for business pros from Jack Wallen.